Tetragon brings eBPF runtime security in-kernel for cloud-native fleets

Tetragon, a sub-project of Cilium and a Cloud Native Computing Foundation project, gives Kubernetes-aware teams runtime observability and optional in-kernel policy enforcement built on eBPF. For managed service providers running mixed customer fleets, it adds a detection and control layer that sits below what container scanners and admission controllers can see.

Enforcement that runs inside the kernel

Unlike tools that ship every event to userspace before deciding what to do, Tetragon filters and enforces policy directly inside the eBPF program that observes the syscall. That closes the window between detection and action that userspace-only tools leave open, and keeps overhead low enough for production use. The project can track process execution, file access and network activity, then tie each event back to the pod and container that produced it, without a sidecar per workload.

Where it fits alongside existing controls

Tetragon does not replace image scanning or CI gates; it covers what happens after a workload is already running. A practical rollout starts small: inventory which namespaces already have a TracingPolicy applied, then extend coverage to critical customer workloads first. Policies belong in version control like any other configuration, so changes go through the same review as code.

• Start with alert-only policies on sensitive namespaces before enabling blocking enforcement.
• Watch for unexpected process execution and access to sensitive files as the first detection rules.
• Forward Tetragon events to the SIEM already used for other fleet alerting.
• Keep policy definitions in git so changes are reviewed like code.

A companion for secret hygiene

Tetragon watches running workloads; it does not check what is already committed to a repository. TruffleHog, a widely used open-source secret-scanning tool, fills that gap by finding and verifying credentials in code before they reach production. Running it in CI on every pull request, and verifying findings before any rotation, keeps the two tools focused on different stages of the same problem.

Neither tool substitutes for the other. Combining runtime enforcement with pre-commit secret scanning gives MSPs coverage at both ends of the pipeline without adding attack detail to customer-facing documentation.

Sources: Tetragon documentation, GitHub — cilium/tetragon.